NebuAD CEO defends web tracking, tells Congress it’s legal

The Senate took on behavioral advertising today as the CEO of NebuAd showed up …

In a Senate hearing on targeted advertising this morning that eventually devolved into conversations about post-nasal drip, Senator Byron Dorgan (D-ND) did get in one good shot at NebuAd, the controversial firm that hopes to harvest ISP traffic data on an opt-out basis to deliver more relevant ads. "Isn't that just wiretapping?" Dorgan asked. NebuAd's CEO looked a bit uncomfortable with the question. "My lawyers have told me we're in compliance with the law," he offered.

Robert Dykes, NebuAd's CEO, stressed repeatedly that his company uses one-way hashes to obscure IP addresses and that it collects no personally identifying information. Instead, NebuAd analyzes web page data and notes whether a user is interested in certain ad categories; if so, web companies that partner with NebuAd can deliver targeted ads in those areas of interest. So what's the problem?

Leslie Harris of the Center for Democracy and Technology countered that federal and state law are the problems. The Wiretap Act, she said, doesn't care if information is personally identifying or not; it cares only whether wire data is being intercepted, not whether the interception is "good" or "bad." In her view, if the interception happens without "affirmative, express consent," it may well be illegal. In addition, many state laws require two-party consent for this sort of thing, and no matter how much "notice" a company gives people, without consent, such practices could run afoul of these laws.

"Consumers are largely uncomfortable with the practice" of third parties riffling through their web traffic without consent," she said, but Dykes countered that his company was really helping ISPs to pay for bandwidth upgrades (though somehow they've managed to do so up until now without selling their users' traffic to third parties).

The Federal Trade Commission was also on hand to assure Congress that it was looking into the general issue of behavioral advertising, but its current plan is to let the industry regulate itself. Harris noted that a major industry effort, the Network Advertising Initiative, has been around for years, but only launched an overhaul of its best practices after the FTC began looking into the issue.

Google, which is hoping to join the NAI, had initially refused to slap a "privacy" link on its front page like most other members did, and only last week did it relent. With a Google attorney testifying today at the hearing, Congressional scrutiny likely had something to do with the decision; no one likes to show up before Congress only to face questions about why their company can put links to advertising and business opportunities on the home page, but can't find space for privacy.

A Microsoft lawyer at the hearing took the opportunity to make an oblique attack on Google, though, pointing out that Microsoft has had a clear link to its privacy on its home page "for several years."

Not every company in attendance was against federal privacy law in this area, but the general sentiment seemed to be in favor of self-regulation. Clyde Wayne Crews of the Competitive Enterprise Institute was on hand to tell the senators that regulation (in general, apparently) wasn't needed, since everything is regulated already by "furious consumers and shareholders." This assumes, of course, both information symmetry and a truly competitive market; certainly, neither bit of "regulation" has done much for cable TV, which routinely comes up at the bottom of consumer satisfaction surveys and has prices increase by a 100 percent a decade.

The ISP market in much of the country is in a similar position, usually with only a pair of decent options. If more than a few ISPs began adopting NebuAd-style behavioral advertising on an opt-out basis and consumers don't like it, there may be little they can do. Senator Dorgan took issue with Crews' point, saying that if it were taken to a logical extreme, we wouldn't need the FDA inspecting food, since people would just stop buying products that made them horribly ill.

As for information symmetry, Dorgan noted that neither he nor most consumers "have the foggiest idea" about what's being tracked, how long it's maintained, and what it's being used for. No pending legislation appears to be in the works, especially with a few months until a new Congress, and most senators seemed inclined to wait for the FTC to conclude its own work on behavioral advertising in the next few months before visiting the issue seriously.